From pierre.labanowski at xlim.fr Mon Feb 4 11:17:30 2019 Content-Type: multipart/mixed; boundary="===============0369969343480520442==" MIME-Version: 1.0 From: Pierre Labanowski To: freeipa-users at lists.fedorahosted.org Subject: [Freeipa-users] Use of certificates is failing Date: Mon, 04 Feb 2019 12:16:40 +0100 Message-ID: --===============0369969343480520442== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hello, I have some issues with certificate management. 2 important points of the recent information: - after a longstanding loss of the certification authority. The = certification authority was deleted and a new one was created. https://frasertweedale.github.io/blog-redhat/posts/2018-05-31-replacing-los= t-ca.htm = = ( very big thx ) - For http and ldap, i use 3rd part certificates ( = /ipa-server-certinstall /) So far, I've noticed=C2=A0 2 problems : 1=C2=B0) ipa-server-upgrade : failed Impossible to upgrade the server. i have a 401 error return when the upgrade script wants to access the url: > GET request https://freeipa4.exemple.fr:8443/ca/rest/account/login > ... > response status 401 for this problem, I followed this information : = https://floblanc.wordpress.com/2017/09/11/troubleshooting-freeipa-pki-tomca= td-fails-to-start/ certificate on //etc/pki/pki-tomcat/alias///is the same pkiuser on the = LDAP server internaldb.ldapauth.authtype=3DSslClientAuth so I don't know why I have a 401 error. // 2=C2=B0) ipa=C2=A0 cert-request --principal : failed ipa: ERROR: impossible de se connecter =C3=A0 = =C2=AB=C2=A0https://freeipa4.exmple.fr:443/ca/eeca/ca/profileSubmitSSLClien= t=C2=A0=C2=BB=C2=A0: = (SSL_ERROR_BAD_CERT_ALERT) SSL peer cannot verify your certificate this is strange because on this port 443 i use a 3rd part certificates do you have any idea what the problem is? I'm lost I don't know what to = look for anymore. thank you in advance Pierre here are some excerpts from the log ----- IPA server version 4.4.0. API version 2.213 ----- ipaupgrade.log : ''' 2019-01-29T16:48:21Z DEBUG request GET = https://freeipa4.exemple.fr:8443/ca/rest/account/login 2019-01-29T16:48:21Z DEBUG request body '' 2019-01-29T16:48:21Z DEBUG NSSConnection init freeipa4.exemple.fr 2019-01-29T16:48:21Z DEBUG Connecting: XX.XX.XX.XX:0 2019-01-29T16:48:21Z DEBUG approved_usage =3D SSL Server intended_usage =3D = SSL Server 2019-01-29T16:48:21Z DEBUG cert valid True for = "CN=3Dfreeipa4.exemple.fr,O=3Dexemple.FR" 2019-01-29T16:48:21Z DEBUG handshake complete, peer =3D XX.XX.XX.XX:8443 2019-01-29T16:48:21Z DEBUG Protocol: TLS1.2 2019-01-29T16:48:21Z DEBUG Cipher: TLS_RSA_WITH_AES_256_CBC_SHA 2019-01-29T16:48:21Z DEBUG approved_usage =3D SSL Server intended_usage =3D = SSL Server 2019-01-29T16:48:21Z DEBUG cert valid True for = "CN=3Dfreeipa4.exemple.fr,O=3Dexemple.FR" 2019-01-29T16:48:21Z DEBUG handshake complete, peer =3D XX.XX.XX.XX:8443 2019-01-29T16:48:21Z DEBUG Protocol: TLS1.2 2019-01-29T16:48:21Z DEBUG Cipher: TLS_RSA_WITH_AES_256_CBC_SHA 2019-01-29T16:48:21Z DEBUG response status 401 2019-01-29T16:48:21Z DEBUG response headers {'content-length': '964', = 'content-language': 'fr', 'expires': 'Thu, 01 Jan 1970 01:00:00 CET', = 'server': 'Apache-Coyote/1.1', 'cache-control': 'private', 'date': 'Tue, = 29 Jan 2019 16:48:21 GMT', 'content-type': 'text/html;charset=3Dutf-8', = 'www-authenticate': 'Basic realm=3D"C} 2019-01-29T16:48:21Z DEBUG response body 'Apache = Tomcat/7.0.69 - Rapport d\'\'erreur